using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.Options;
using ZB.MOM.WW.Auth.Abstractions.ApiKeys;

namespace ZB.MOM.WW.Auth.ApiKeys.DependencyInjection;

/// <summary>
/// Configuration-backed <see cref="IApiKeyPepperProvider"/> that resolves the API-key pepper
/// from <see cref="IConfiguration"/> using the key name in
/// <see cref="ApiKeyOptions.PepperSecretName"/>.
/// </summary>
/// <remarks>
/// The pepper is read live from configuration on each call so that a secret rotated in the
/// underlying provider (e.g. an environment variable or a refreshed secret store) takes effect
/// without restarting the process. When the secret name is unconfigured or the value is absent,
/// <see cref="GetPepper"/> returns <see langword="null"/>/empty, which the verifier treats as a
/// fail-closed "pepper unavailable" condition.
/// </remarks>
public sealed class ConfigurationApiKeyPepperProvider(
    IConfiguration config,
    IOptions<ApiKeyOptions> options) : IApiKeyPepperProvider
{
    /// <inheritdoc />
    public string? GetPepper()
    {
        string secretName = options.Value.PepperSecretName;

        return string.IsNullOrWhiteSpace(secretName)
            ? null
            : config[secretName];
    }
}
